guard-users-gemini

Classify Gemini CLI requests into risk classes and generate approvals.

Updated Feb 23, 2026

Search Tags:#credentials #gemini #guardrails #approvals #risk-classification #cli-security

Ready to run

npx skills add https://github.com/AndrewRober/CodexCli-GuardRails --skill guard-users-gemini

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: guard-users-gemini
Source: https://github.com/AndrewRober/CodexCli-GuardRails/tree/main/skills/guard-users-gemini
Command: npx skills add https://github.com/AndrewRober/CodexCli-GuardRails --skill guard-users-gemini

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a safety-first guardrail policy for Gemini CLI usage that refuses catastrophic actions, requires scoped approvals, and reduces secret leakage.

Core Features & Use Cases

Enforces risk classifications (Class X, Class 3, Class 2, Class 1, Class 0) and requires explicit approvals for Class 2/3.
Defines the exact-payload approval format and workspace-scoping rules to prevent unsafe executions.
Outlines safe defaults for credential handling and cloud interactions, helping teams avoid leakage and unapproved access.

Quick Start

Apply the Gemini guardrail policy to a sample command to verify risk classification and required approvals.

Frequently Asked Questions about guard-users-gemini

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add guardrails to Gemini CLI to prevent destructive actions?▼

To add guardrails to Gemini CLI, apply a safety policy that classifies requests into risk classes and requires explicit approvals for destructive actions. This enforces scoped executions and confines operations to the workspace root.

What risk classifications are used for Gemini CLI security policies?▼

Gemini CLI security policies use risk classifications ranging from Class X to Class 0. Class X refuses catastrophic actions, while Class 2 and Class 3 require explicit approvals using an exact-payload approval format before execution.

Can I require manual approvals for high-risk Gemini CLI commands?▼

Yes, you can require manual approvals for high-risk Gemini CLI commands by enforcing a policy that targets Class 2 and Class 3 risk classifications. These commands require an exact-payload approval format before they can execute.

How do I stop credential leakage when running Gemini CLI scripts?▼

To stop credential leakage when running Gemini CLI scripts, enforce safe defaults for credential handling and cloud interactions. The guardrail policy confines the working directory to the workspace root to prevent unapproved access.

Does the Gemini CLI guardrail policy work for automated local scripts?▼

Yes, the Gemini CLI guardrail policy works for automated local scripts. It applies to Gemini CLI workflows in local workspaces and automated scripts, classifying requests to prevent unsafe changes to system state or credentials.

What are the limitations of using risk classification for CLI security?▼

Risk classification policies require exact-payload approvals for Class 2 and Class 3 actions, which can halt automated scripts if approvals are not pre-configured. Workdir is strictly confined to the workspace root, limiting cross-directory operations.